<?php

if(!defined('IN_AACMS') || !defined('IN_ADMINCP')) {
	exit('Access Denied');
}

$mpurl = ADMINSCRIPT.'?action=member&operation='.$operation;
$purl = 'action=member&operation='.$operation;

if($operation == 'list') {
	
	if(submitcheck('submit')) {
		
		if(empty($_POST['ids'])) {
			cpmsg('choose_at_least_one_member', $purl, 'error');
		}
		if(in_array(1, $_POST['ids'])) {
			cpmsg('delete_founder_error', $purl, 'error');
		}
		$ids = dimplode($_POST['ids']);
		
		DB::delete('member', "uid IN($ids)");
		cpmsg('delete_member_succeed', $purl, 'succeed');
	}	
	
	$perpage = 15;
	$page = $_GET['page'] ? max(intval($_GET['page']), 1) : 1;
	$start = ($page - 1) * $perpage;
	
	$count = DB::getOne("SELECT COUNT(*) FROM ".DB::table('member'));
	$member_list = DB::getAll("SELECT * FROM ".DB::table('member')." ORDER BY uid DESC LIMIT $start,$perpage");
	
	$multipage = multi($count, $perpage, $page, $mpurl);
	
	include template('member_list', 'admin');
	
} elseif($operation == 'add') {
	
	if(submitcheck('membersubmit')) {

		if($_POST['email'] && !isemail($_POST['email'])) {
			cpmsg('email_format_error', $purl, 'error');
		}
		if(!check_username($_POST['username'])) {
			cpmsg('username_is_illegal', $purl, 'error');
		}
		if(empty($_POST['password'])) {
			cpmsg('password_is_empty', $purl, 'error');
		}
		if(DB::getOne("SELECT uid FROM ".DB::table('member')." WHERE username='$username'")) {
			cpmsg('username_is_exists', $purl, 'error');
		}
		if($_POST['permit'] && $_POST['groupid'] == 1) {
			if($_SESSION['uid'] != 1) {
				cpmsg('user_notis_superadmin', $purl, 'error');
			}
			$_POST['permit'] = serialize($_POST['permit']);
		}
		
		$_POST['salt'] = random(6);
		$_POST['password'] = md5(md5($_POST['password']).$_POST['salt']);
		$_POST['groupid'] = in_array($_POST['groupid'], array(0,1)) ? $_POST['groupid'] : 0;
		$_POST['timeoffset'] = intval($_POST['timeoffset']);
		$_POST['regdate'] = TIMESTAMP;
		$_POST['regip'] = $_G['clientip'];
		$_POST['lastlogintime'] = TIMESTAMP;
		$_POST['lastloginip'] = $_G['clientip'];
		
		if(DB::insert('member', $_POST)) {
			cpmsg('member_add_succeed', 'action=member&operation=list', 'succeed');
		} else {
			cpmsg('member_add_error', 'action=member&operation=list', 'error');
		}
		
	}
	
	$permit = cplang('permit');
	include template('member_form', 'admin');
	
} elseif($operation == 'edit') {
	
	$uid = intval($_GET['uid']);
	
	if(submitcheck('membersubmit')) {
		
		if($_POST['email'] && !isemail($_POST['email'])) {
			cpmsg('email_format_error', $purl."&uid=$uid", 'error');
		}
		if($_POST['password'] && $_POST['groupid'] == 1 && $_SESSION['uid'] != $uid && $_SESSION['uid'] != 1) {
			if($_SESSION['uid'] != 1) {
				cpmsg('user_notis_superadmin', $purl."&uid=$uid", 'error');
			}
		}
		if($_POST['password']) {
			$_POST['salt'] = random(6);
			$_POST['password'] = md5(md5($_POST['password']).$_POST['salt']);
		} else {
			unset($_POST['password']);
		}
		if($_POST['permit'] && $_POST['groupid'] == 1) {
			if($_SESSION['uid'] != 1) {
				cpmsg('user_notis_superadmin', $purl."&uid=$uid", 'error');
			}
			$_POST['permit'] = serialize($_POST['permit']);
		} else {
			$_POST['permit'] = '';
		}
		
		$_POST['groupid'] = in_array($_POST['groupid'], array(0,1)) ? $_POST['groupid'] : 0;
		$_POST['timeoffset'] = intval($_POST['timeoffset']);
		
		
		if(DB::update('member', $_POST, "uid='$uid'")) {
			cpmsg('member_edit_succeed', 'action=member&operation=list', 'succeed');
		} else {
			cpmsg('member_edit_error', 'action=member&operation=list', 'error');
		}
		
	}
	
	$member = DB::getRow("SELECT * FROM ".DB::table('member')." WHERE uid='$uid'");
	$member['permit'] = unserialize($member['permit']);
	$permit = cplang('permit');
	
	include template('member_form', 'admin');
	
} elseif($operation == 'delete') {
	
	$uid = intval($_GET['uid']);
	
	if($uid == 1) {
		cpmsg('delete_founder_error', $purl, 'error');
	}
	
	DB::delete('member', "uid='$uid'");
	cpmsg('delete_member_succeed', 'action=member&operation=list', 'succeed');

} elseif($operation == 'login') {
	
	if(submitcheck('loginsubmit')) {
		
		$username = $_POST['admin_username'];
		$password = $_POST['admin_password'];
		
		$member = DB::getRow("SELECT * FROM ".DB::table('member')." WHERE username='$username'");
		$password = md5(md5($password).$member['salt']);

		if($password == $member['password'] && $member['groupid'] == 1) {
			$_SESSION['uid'] = $member['uid'];
			$_SESSION['username'] = $member['username'];
			$_SESSION['timeoffset'] = $member['timeoffset'];
			$_SESSION['groupid'] = $member['groupid'];
			$_SESSION['permit'] = $member['permit'] ? unserialize($member['permit']) : '';
		}
		
		dheader(ADMINSCRIPT);
		
	} else {
		
		@include_once ROOT.'./source/aacms_version.php';	
		include template('member_login', 'admin');
	}
	
} elseif($operation == 'logout') {
	
	$core->session->destroy_session();
	dheader(ADMINSCRIPT);
}

function check_username($username) {
	$guestexp = '\xA1\xA1|\xAC\xA3|^Guest|^\xD3\xCE\xBF\xCD|\xB9\x43\xAB\xC8';
	$len = dstrlen($username);
	if($len > 32 || $len < 3 || preg_match("/\s+|^c:\\con\\con|[%,\*\"\s\<\>\&]|$guestexp/is", $username)) {
		return FALSE;
	} else {
		return TRUE;
	}
}

?>